USB Reloaded USB Reloaded: The Teensy Attack Eric Conrad

USB Reloaded A Quick Note This talk was presented The SANS360: Top Security Takeaways –10 speakers, each given 360 seconds –See: –So this slide deck is designed for speed Technical details (such as code) are omitted here –See: for more technical details about the Teensy attack

USB Reloaded It's Baaaaack We mitigated the USB attack vector –Right? –Malware launched via autorun.inf on USB flash media is mitigated by KB , , etc.

USB Reloaded There's More Than One Way to Do it USB Flash media is just one of many USB technologies Another is USB Human Interface Device (HID) –AKA a USB Keyboard/Mouse –These can be programmed to deliver keystrokes and mouse movements

USB Reloaded Which is Which? This is a disk This is a keyboard

USB Reloaded Meet Teensy "The Teensy is a complete USB-based microcontroller development system, in a very small footprint, capable of implementing many types of projects." Source: This is a keyboard

USB Reloaded How Much Data Can a Teensy Store? Teensy 2.0: 2560 bytes Teensy++ 2.0: 8192 bytes Teensy++ 2.0: 8192 bytes + 2 gigs SD storage

USB Reloaded Keyboard vs. Keyboard This is USB a keyboard This is also a USB keyboard Both can send keystrokes

USB Reloaded What can you do With Keystrokes? Run any command the logged in user can execute –Disable the firewall and enable services –Surf to a website, download a malicious payload and execute it Type an encoded Metasploit payload into a file, convert to exe and execute it –No network connectivity required –Air-gapped network FTW!

USB Reloaded What This Means This still works: Patching doesn't (currently) mitigate this risk [1] How Digital Detectives Deciphered Stuxnet, the Most Menacing Malware in History, Kim Zetter, Wired Magazine, July

USB Reloaded How Bad Could it Be? Question: what is vulnerable? –Answer: any logged-in system that allows a HID to send keystrokes, without requiring any interaction beyond insertion Follow-up question: what OSs allow that by default? –Let's find out!

USB Reloaded Let's Play… Will it PWN? The rules: –The goal: display a harmless message on the target system by inserting a pre-programmed Teensy USB device –Will also execute "uname –a" (or equivalent) –Attacker may insert the USB only: no other (human) system interaction is allowed –All target OSs are the most recent release, with default settings

USB Reloaded Meet Beensii USB + Teensy + ASCII == Beensii, our mascot If Beensii displays, the system is PWNed || || || ______________________ || || / \ || || / All your USB Ports | / | | | / Are belong to me | | o o | | | | __ | ---\__________________________/

USB Reloaded Ubuntu Linux Server 11.10: Will it PWN?

USB Reloaded It PWNs!

USB Reloaded FreeBSD 9.0: Will it PWN?

USB Reloaded It PWNS!

USB Reloaded Fedora Linux 16: Will it PWN?

USB Reloaded It PWNs!

USB Reloaded Windows 7: Will it PWN?

USB Reloaded It PWNs!

USB Reloaded Mac OS X Lion: Will it PWN?

USB Reloaded It PWNs!

USB Reloaded OpenBSD 5.0: Will it PWN?

USB Reloaded It PWNs!!

USB Reloaded Mitigation Options Restricting HIDs to known VIDs (Vendor IDs) and PIDs (Product IDs) is one option Logitech MK 320 Wireless Keyboard VID: 046D PID:C52E

USB Reloaded Beensii Strikes Again A Teensy can be programmed with any VID/PID –If the VID/PID isn't known, common VIDs/PIDs can be guessed

USB Reloaded More Mitigation Options Other values, such as the unique serial number, may be tracked or blocked. But these are often left blank by the vendor Blank serial number Software: USBDeview, from NirSoft

USB Reloaded Mitigation Continued Consider restricting the installation of HIDs –Microsoft TechNet Article "Prevent Installation of Removable Devices" Adrian Crenshaw's Shmoocon talk Plug and Prey: Malicious USB Devices has more mitigation recommendations Links to both (and a copy of this presentation) at In secure environments, use only HIDs that include values such as unique serial number, and lock systems down to each specific HID

USB Reloaded References _____________________________________________________ || || / \ || || | I'd like to thank the following folks for making me | || || | possible: | || || | | || || | ( | || || | | || || | ( | || || | | || || | Paul and Robin at | || || | | || || | Astrobaby: | || || | | || || | Adrian Crenshaw: | | | | | | And Emma Conrad, for the photography and nifty | | o o | | red hat she made for Tux | | __ | \_____________________________________________________/

USB Reloaded Thank You! || || || ________________________________ || || / \ || || | Go to to \ || || | \ || || | download a copy of this | || || | | || || | presentation, get more info | || || | | || || | on mitigation options, and | || || | | || || | download the code used | | | | | | in this presentation. | | o o | /\__________________________________/ | __ |